Subject: [saag] Comments: SAAG SSL-VPN Preso

From: "Gregory M. Lebovitz" <[email-masked]>
Date: Thu, 31 Jul 2008 06:37:12 -0700

Paul Hoffman delivered a very helpful survey of SSL-VPN's, based on 
work done by his VPNConsortium, and captured also in a document he 
authored: "NIST SP 800-113, Guide to SSL VPNs". See his slides here: 
http://www.ietf.org/proceedings/08jul/slides/saag-2.pdf .

Thanks, Paul, for this very helpful preso.

As someone with deployment experience with these products and their 
usage (read: my day job sells these types of devices), I have some 
comments and/or clarifications that others may find useful.

1 - Paul's slides say "SSL-VPN" repeatedly. While the market refers 
to them as such, they are really mostly TLS-VPNs at this point. Paul 
mentioned that TLS is used toward the end of this slides, but I 
wanted to clarify, because SSL-VPN is used widely.

2 - there are (at least) three types of TLS-VPN functional modes. 
Paul listed 2, web-proxy-rewriter and full network access. The 3rd is 
a per-application forwarding and protection. This type is different 
from the other two in that one or more specific application types 
(e.g. MAPI, CIFS, HTTP, etc.) can be made to be forwarded off the 
client through the TLS tunnel, while no other traffic would pass 
through the VPN.

3 - Paul referred to an issue of a "Silent gateway-in-the-middle 
attack" that is a security consideration/weakness of the TLS-VPNs. 
Users of these products (and they are many, the majority now) might 
find this characterization contrary to their perspective. The 
entities that operate TLS-VPNs use them precisely to be able to know 
and control what is and isn't going in and out of their networks. 
They see these HTTPS forward-proxy-like features as a wonderful 
enforcement tool of their entity's security policy for maintaining 
their networks and securing/control their data.

Hope these clarifications help.

Gregory Lebovitz

+++++++++++++++++++++++
IETF-related email from
Gregory M. Lebovitz
Juniper Networks
g r e go r  y d o t  i e tf a t  g m a i l  do t c o  m 

_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: "Mike Kraus (mikraus)" <[email-masked]>
Date: Thu, 31 Jul 2008 09:52:44 -0400

In regards to #1 below, some vendors implement and prefer the use of
DTLS as a transport over TLS (especially for real-time traffic).  So,
generically referring to all SSL VPN technologies as TLS-VPNs is also
limiting.  While DTLS was spawned from the learnings of TLS, it
certainly is its own protocol.  I agree that SSL VPN as a categorical
name isn't 100% accurate but it is what the industry has adopted as the
categorical term.  So, in the context of the presentation I would
probably would have done the same...

I do agree on points 2 & 3.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Gregory M. Lebovitz
Sent: Thursday, July 31, 2008 8:37 AM
To: [email-masked]
Subject: [saag] Comments: SAAG SSL-VPN Preso

Paul Hoffman delivered a very helpful survey of SSL-VPN's, based on work
done by his VPNConsortium, and captured also in a document he
authored: "NIST SP 800-113, Guide to SSL VPNs". See his slides here: 
http://www.ietf.org/proceedings/08jul/slides/saag-2.pdf .

1 - Paul's slides say "SSL-VPN" repeatedly. While the market refers to
them as such, they are really mostly TLS-VPNs at this point. Paul
mentioned that TLS is used toward the end of this slides, but I wanted
to clarify, because SSL-VPN is used widely.

2 - there are (at least) three types of TLS-VPN functional modes. 
Paul listed 2, web-proxy-rewriter and full network access. The 3rd is a
per-application forwarding and protection. This type is different from
the other two in that one or more specific application types (e.g. MAPI,
CIFS, HTTP, etc.) can be made to be forwarded off the client through the
TLS tunnel, while no other traffic would pass through the VPN.

3 - Paul referred to an issue of a "Silent gateway-in-the-middle attack"
that is a security consideration/weakness of the TLS-VPNs. 
Users of these products (and they are many, the majority now) might find
this characterization contrary to their perspective. The entities that
operate TLS-VPNs use them precisely to be able to know and control what
is and isn't going in and out of their networks. 
They see these HTTPS forward-proxy-like features as a wonderful
enforcement tool of their entity's security policy for maintaining their
networks and securing/control their data.

Gregory Lebovitz

+++++++++++++++++++++++
IETF-related email from
Gregory M. Lebovitz
Juniper Networks

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 31 Jul 2008 07:24:49 -0700

At Thu, 31 Jul 2008 09:52:44 -0400,
Mike Kraus (mikraus) wrote:
> DTLS as a transport over TLS (especially for real-time traffic). 

People actually do this now? That's great!

Does Cisco do it?

-Ekr

---

From: "Mike Kraus (mikraus)" <[email-masked]>
Date: Thu, 31 Jul 2008 10:35:20 -0400

Yes, see top item on:

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnec
t20/administrative/guide/admin5.html  

-----Original Message-----
From: Eric Rescorla [mailto:[email-masked]] 
Sent: Thursday, July 31, 2008 9:25 AM
To: Mike Kraus (mikraus)
Cc: Gregory M. Lebovitz; [email-masked]
Subject: Re: [saag] Comments: SAAG SSL-VPN Preso

Does Cisco do it?

-Ekr